Event 1000 and 1001 errors on app pool refresh RRS feed

  • Question

  • User268360977 posted

    I'm getting the following errors in my Windows event logs when the app pools recycle and was hoping someone has come across them before and has a resolution:

    EventID: 1000, Source: IIS Advanced Logging Module

    Failed to create the log file G:\AdvancedIISLogs\XXXX.log. The log definition has been disabled. HRESULT: 0x0X80070005.

    EventID: 1001, Source: IIS Advanced Logging Module

    Failed to write data to the log file G:\AdvancedIISLogs\XXXX. HRESULT: 0x0X80070006.

    Contrary to what the error says, the log files are actually created and have the correct App Pool permissions on it to allow for modifications. Thanks.

    Sunday, May 3, 2015 8:55 PM

All replies

  • User-801366587 posted

    Hi Mafy,

    Probably this can be an NTFS issue. Make sure the your application pool identity (Network Service in most cases) has proper permission to log file directory.

    NETWORK SERVICE must be included as a DACL w/ READ/WRITE/MODIFY

    Similar Discussion - http://forums.iis.net/t/1169766.aspx?IIS+7+Advanced+Logging+Error+Failed+tocreate+log+file+

    Mark as answer if this helped youSmile

    Tuesday, May 5, 2015 9:05 AM
  • User268360977 posted

    Hi Bharath,

    Each individual application pool identity (Running multiple sites) has permissions to their own Advanced IIS Log, adding Network Service seems like overkill and over granting permissions. Thoughts?



    Friday, May 8, 2015 1:37 AM
  • User-801366587 posted
    Ther is change for correlation between what credentials w3wp.exe is going pass based on Application Pool Identity. The discussion which I have suggested you has faced the same priblem. So probably provide proper permission to network service in log directory and check whether it works or not.

    Mark as answer if this helped you.
    Friday, May 8, 2015 10:53 PM
  • User268360977 posted

    I've added the permissions to the folder and refreshed the app pools but the errors are still appearing.

    Tuesday, May 12, 2015 9:05 PM